{"id":"CVE-2026-89919","summary":"KVM: s390: keyop: use mmu_lock to read gmap-\u003easce","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: s390: keyop: use mmu_lock to read gmap-\u003easce\n\nEvery other dat_* consumer in this file (kvm_s390_get_skeys,\nset_skeys, get_cmma_bits, set_cmma_bits, MEM_CLR_CMMA,\nkvm_s390_fixup_prefix, kvm_test_age_gfn, kvm_age_gfn) reads\nkvm-\u003earch.gmap-\u003easce *inside* the mmu_lock read-side. keyop is the only\noutlier.\n\ngmap-\u003easce is mutated under write_lock(mmu_lock) by gmap_set_limit()\nand keyop might use a stale asce value for walking as KVM_S390_KEYOP\nand KVM_S390_VM_MEM_LIMIT_SIZE can run concurrently. This can result\nin memory corruption.","modified":"2026-09-18T03:48:33.984860453Z","published":"2026-09-16T10:32:14.013Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89919.json","cna_assigner":"Linux"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/ae452b990e0544425f77045351c56e77158858e7"},{"type":"WEB","url":"https://git.kernel.org/stable/c/da07a751efa4583385f9f0f47113549fe8871242"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89919.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89919"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"0ee4ddc1647b8b3b9e7a94d798a1774a764428c1"},{"fixed":"ae452b990e0544425f77045351c56e77158858e7"},{"fixed":"da07a751efa4583385f9f0f47113549fe8871242"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-89919.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"fixed":"7.2.5"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-89919.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}